OK, I see to get rid of the comma I forgot in there, using atob is now ~1048 characters, lol. Unless we have a shorter way to access window than []["sort"]["call"], without using comma. Seems quite infeasible without using variables.

Could you explain how it's strategically better to use filter.constructor than window.eval? I think they are around the same length, well, I don't mind which is used. :)

Good tip on the numbers, I will fix this and the nested quotes. One problem with using filter.constructor("eval(...)") is if you need quotes it will be quite long, I think it's like 500 characters to generate a ".

New version:
http://discogscounter.getfreehosting.co.uk/js-noalnum_com.php?txt=alert%28%22XSS%22%29

Changes:
- no regex, recursive parsing, so no stepping
- added rest of letters and symbols
- allows single/double quotes, no nested
- deals with numbers vs. string numbers
- there are a few "optimizations" still to be worked out, both on the letters, and on the wrapping rules
- should be easily extensible to other charsets & to add variables